Security Engineer, Lead

Toyota•Plano, TX

About The Position

Toyota Financial Services (TFS) is seeking a Lead Cyber Security Engineer to architect, deploy, optimize, and maintain its Security Information and Event Management (SIEM) and Security Orchestration, Automation, and Response (SOAR) platforms. Operating under the Information Security mandate, the role leads engineering efforts to ensure comprehensive log ingestion, detection fidelity, platform health, and automation capabilities that support the Security Operations Center (SOC) and broader cyber defense teams. The engineer will build scalable, resilient security infrastructure that strengthens Toyota's detection and response posture. The position encompasses SIEM and SOAR engineering, agent deployment and endpoint telemetry, detection engineering, data source management, scripting and automation, and the development of operational processes and documentation. The role collaborates with SOC analysts, infrastructure teams, threat intelligence teams, and leadership. Toyota does not provide immigration-related employment visa or work authorization sponsorship for this role; applicants must be authorized to work in the United States without Toyota sponsorship now or in the future.

Requirements

At least 5 years of experience in cybersecurity engineering.
Hands-on expertise in SIEM administration and engineering, SOAR platform development, log management, data source onboarding, and security agent deployment and lifecycle management.
Subject matter expertise in one or more SIEM/SOAR platforms, such as Splunk, Microsoft Sentinel, Chronicle, Elastic, Palo Alto XSIAM/XSOAR, Phantom, or Swimlane.
Strong understanding of log source types, parsing methodologies, data normalization techniques, and common log formats such as Syslog, CEF, JSON, XML, and Windows Event Logs.
Proficiency in scripting languages, particularly Python and PowerShell, with demonstrated ability to build automation, custom integrations, and engineering tooling.
Excellent communication skills and ability to collaborate with and influence stakeholders at all levels, including SOC analysts, infrastructure teams, and leadership.
Must have the right to work in the United States without Toyota immigration-related employment sponsorship now or in the future.

Nice To Haves

Bachelor's degree in a relevant field such as Cybersecurity, Computer Science, Engineering, or Information Technology, or equivalent work experience.
Experience in a regulated industry such as finance, healthcare, or government.
Proficiency in additional query and scripting languages such as CQL, SQL, KQL, SPL, EQL, Yara, or Bash.
Experience with security agent platforms such as CrowdStrike Falcon or Halcyon.
Proficiency in AWS and Azure cloud environments, including cloud-native logging, data flows, and access management.
Experience building and maintaining API-based integrations between security tools and platforms.
Familiarity with CI/CD pipelines and infrastructure-as-code practices applied to security tooling.
AWS certifications: AWS Certified Security – Specialty, AWS Certified Solutions Architect – Associate or Professional, or AWS Certified SysOps Administrator – Associate.
Azure certifications: Microsoft Certified: Security Operations Analyst Associate (SC-200), Azure Security Engineer Associate (AZ-500), or Azure Administrator Associate (AZ-104).
Cribl certifications: Cribl Certified Observability Engineer (CCOE) or Cribl Certified Admin.
CrowdStrike certifications: CrowdStrike Certified Falcon Administrator (CCFA), Falcon Responder (CCFR), or Falcon Hunter (CCFH).

Responsibilities

Lead design, configuration, and ongoing maintenance of complex SIEM environments, including onboarding and managing diverse data sources and ensuring proper log parsing, normalization, and enrichment.
Monitor SIEM platform health, troubleshoot ingestion failures, and optimize storage and performance.
Design, build, and maintain SOAR playbooks and automated workflows for alert triage, enrichment, and response actions.
Identify automation opportunities that reduce manual effort and improve mean time to detect and mean time to respond.
Lead deployment, configuration, and lifecycle management of security agents across on-premises, cloud, and hybrid endpoint environments.
Ensure consistent agent coverage, policy enforcement, and telemetry collection across the enterprise.
Develop and tune SIEM detection rules, correlation logic, and alerting thresholds to improve signal-to-noise ratio and detection accuracy.
Partner with threat intelligence and SOC teams to translate emerging threats into actionable detection content.
Manage the lifecycle of data source integrations, including scoping, onboarding, validation, and ongoing health monitoring.
Use scripting languages such as Python and PowerShell to build tooling, automate engineering tasks, develop API integrations, and extend platform capabilities.
Assist with developing and maintaining standard operating procedures, engineering runbooks, and documentation for data source onboarding, platform maintenance, and incident support workflows.
Continuously refine processes to improve efficiency and consistency.

Benefits

Professional growth and development programs.
Tuition reimbursement.
Team Member Vehicle Purchase Discount.
Toyota Team Member Lease Vehicle Program, if applicable.
Comprehensive health care and wellness plans for the employee's family.
Toyota 401(k) Savings Plan with company match and an annual retirement contribution, if applicable.
Paid holidays and paid time off.
Referral services related to prenatal services, adoption, childcare, schools, and more.
Tax-advantaged accounts, including Health Savings Account, Health Care FSA, and Dependent Care FSA.
Relocation assistance, if applicable.
Teamwork-, flexibility-, and respect-oriented work environment.